Next release - #1734
Conversation
- Introduced a new plugin for monitoring website health, including functionality to check URLs and log results. - Created README and configuration files for the workflows plugin, detailing its purpose and settings. - Updated import paths in various test files to reflect the new directory structure. - Ensured compatibility of test cases with the updated plugin architecture.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe plugin directory is relocated from ChangesPlugin relocation
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 10
Note
Due to the large number of review comments, Critical, Major severity comments were prioritized as inline comments.
🟡 Minor comments (32)
server/plugins/_publisher_mqtt/README.md-3-3 (1)
3-3: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winCorrect the broker name.
Use “Mosquitto” instead of “Mosquito.” (mosquitto.org)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/_publisher_mqtt/README.md` at line 3, Correct the broker name in the README description by replacing “Mosquito” with “Mosquitto,” leaving the surrounding Home Assistant and MQTT wording unchanged.server/plugins/csv_backup/README.md-3-3 (1)
3-3: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winCorrect the documentation proofreading defects.
server/plugins/csv_backup/README.md#L3-L3: Replace “Can be used for importing” with a complete sentence, such as “Use it to import”.server/plugins/db_cleanup/README.md#L11-L11: Replacetehywiththey.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/csv_backup/README.md` at line 3, Correct the documentation proofreading issues: in server/plugins/csv_backup/README.md lines 3-3, replace “Can be used for importing” with a complete sentence such as “Use it to import”; in server/plugins/db_cleanup/README.md lines 11-11, replace the typo “tehy” with “they”.Source: Linters/SAST tools
.gemini/skills/plugin-development/plugin-skill.md-22-22 (1)
22-22: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winMake the manual-run guidance environment-specific.
The command at Line 19 runs from the Gemini CLI repository root. The
/app/server/pluginsand/app/serverpaths in Line 22 are container paths. Use paths derived from__file__, or state that these paths apply only in the container. Otherwise the documented command cannot import shared modules such asplugin_helper.Based on learnings: Gemini runs from the repository root and skill examples must avoid absolute path prefixes.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.gemini/skills/plugin-development/plugin-skill.md at line 22, Update the manual-run guidance in the plugin skill documentation to avoid hardcoded container-only paths: derive plugin and server paths from __file__ in the example, or explicitly restrict the /app/server paths to container execution. Ensure the documented repository-root command can import shared modules such as plugin_helper.Source: Learnings
server/plugins/_publisher_mqtt/README.md-166-186 (1)
166-186: 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick winUse the Home Assistant discovery
configtopic.Home Assistant discovery payloads must be published to
<discovery_prefix>/<component>/[<node_id>/]<object_id>/config. Change the README topic tohomeassistant/binary_sensor/mac_44_ef_44_ef_44_ef/is_present/config. The MQTT code already publishes discovery configs on theconfigtopic.Proposed documentation fix
-Topic: `homeassistant/binary_sensor/mac_44_ef_44_ef_44_ef/is_present/` +Topic: `homeassistant/binary_sensor/mac_44_ef_44_ef_44_ef/is_present/config`🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/_publisher_mqtt/README.md` around lines 166 - 186, The README discovery topic must use the Home Assistant config endpoint. Update the documented topic for the binary sensor example to append /config, matching the discovery topic format and the MQTT publisher’s existing behavior.server/plugins/icmp_scan/README.md-3-3 (1)
3-3: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winCorrect the spelling error.
Change
suplementing pluginstosupplementing plugins.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/icmp_scan/README.md` at line 3, Correct the spelling of “suplementing plugins” to “supplementing plugins” in the README description.Source: Linters/SAST tools
server/plugins/freebox/README.md-11-11 (1)
11-11: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winCorrect the setup wording.
Change
se [remote setup]tosee [remote setup]. ChangeFreeboxe'stoFreebox's. Use clear UI formatting such asSettings > Access Management.Also applies to: 35-35
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/freebox/README.md` at line 11, Update the setup documentation wording: replace “se [remote setup]” with “see [remote setup]”, correct “Freeboxe's” to “Freebox's”, and format the UI navigation path as “Settings > Access Management” wherever applicable.Source: Linters/SAST tools
server/plugins/dhcp_leases/README.md-46-48 (1)
46-48: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winAdd language identifiers to the fenced examples.
markdownlintreports MD040 for the fences on Lines 46, 56, and 68. Use an appropriate identifier such astextfor these lease-file examples.Also applies to: 56-58, 68-81
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/dhcp_leases/README.md` around lines 46 - 48, Update the fenced examples in the README, including the sections around the lease-file examples and the standalone TBC block, to specify an appropriate language identifier such as text after each opening fence. Ensure all referenced fences satisfy markdownlint MD040 without changing their contents.Source: Linters/SAST tools
server/plugins/dhcp_leases/README.md-52-58 (1)
52-58: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winCorrect the sample MAC address.
Line 57 contains seven octets. A MAC address must contain six octets. Use a valid six-octet value in both the MAC address and client ID fields.
Proposed correction
-1715932537 01:5c:5c:5c:5c:5c:5c 192.168.1.115 ryans-laptop 01:5c:5c:5c:5c:5c:5c +1715932537 01:5c:5c:5c:5c:5c 192.168.1.115 ryans-laptop 01:5c:5c:5c:5c:5c🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/dhcp_leases/README.md` around lines 52 - 58, Correct the example lease line in the “Example File Format” section so both the MAC address and client ID use valid six-octet values, preserving the documented field order and remaining sample data.server/plugins/dhcp_leases/README.md-42-48 (1)
42-48: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win** Replace the
TBCplaceholder with a real Pi-hole example. **Pi-hole paths are handled by splitting each line into 5 fields and using field 1 as the primary ID, field 2 as the secondary IP, field 3 as the hostname, and field 4 as the MAC. Provide a concrete 5-field sample that matches that import order so users can map Pi-hole
dhcp.leasesfiles correctly.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/dhcp_leases/README.md` around lines 42 - 48, Replace the TBC placeholder in the pihole format section with a concrete five-field Pi-hole dhcp.leases example, ordered as primary ID, secondary IP, hostname, MAC, and the remaining field, so users can map the import fields correctly.Source: Learnings
server/plugins/ipneigh/README.md-28-28 (1)
28-28: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winCorrect the invalid release date.
November has 30 days.
31-Nov-2024is not a valid date. Replace it with the confirmed release date.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/ipneigh/README.md` at line 28, Update the Release Date entry in the ipneigh README to replace the invalid 31-Nov-2024 value with the confirmed valid release date, preserving the existing date format.server/plugins/kea_api/README.md-99-99 (1)
99-99: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winUse an unambiguous release date.
11/05/2026can mean May 11 or November 5. Use ISO 8601 format and confirm the intended date before merging.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/kea_api/README.md` at line 99, Update the README release date to an unambiguous ISO 8601 date in the Release Date field, confirming whether the intended date is May 11 or November 5, 2026 before applying the change.server/plugins/mikrotik_scan/README.md-25-25 (1)
25-25: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winFix the spelling error in the device-name documentation.
Change
deviestodevices.Proposed fix
-- **Comment**: The `comment` field in the MikroTik router's DHCP lease configuration. This is useful for naming static leases of known devies. +- **Comment**: The `comment` field in the MikroTik router's DHCP lease configuration. This is useful for naming static leases of known devices.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/mikrotik_scan/README.md` at line 25, Correct the spelling in the DHCP lease documentation comment near the `comment` field, changing “devies” to “devices” without altering the surrounding text.Source: Linters/SAST tools
server/plugins/ipneigh/README.md-12-17 (1)
12-17: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winRemove the misleading plugin-settings interface guidance.
ipneigh.pyreadsSCAN_SUBNETS, not a plugin-specific interface field, andconfig.jsonhas no IP Neigh interface setting. Update the line that tells users to add interfaces in plugin settings so users configure onlySCAN_SUBNETS, e.g.192.168.1.0/24 --interface=eth1.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/ipneigh/README.md` around lines 12 - 17, Update the setup guidance in the README to remove the instruction to add interfaces in plugin settings, and direct users to configure interfaces only through the existing SCAN_SUBNETS setting using the documented format. Keep the Usage navigation and example consistent with the ipneigh.py configuration behavior.docs/COMMON_ISSUES.md-120-120 (1)
120-120: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winUse a repository-relative or full repository URL.
Line 120 starts with
/server/.... This is a site-root URL, not a NetAlertX repository path. It can fail on GitHub or the hosted documentation site. Use a verified relative link or the full GitHub URL.Proposed fix
-See how to prevent IP flipping in the [ARPSCAN plugin guide](/server/plugins/arp_scan/README.md). +See how to prevent IP flipping in the [ARPSCAN plugin guide](https://github.com/netalertx/NetAlertX/tree/main/server/plugins/arp_scan/README.md).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/COMMON_ISSUES.md` at line 120, Update the ARPSCAN plugin guide link in COMMON_ISSUES.md to use a verified repository-relative path or the full NetAlertX GitHub URL instead of the site-root `/server/...` path, while preserving the existing link text.server/plugins/pihole_scan/README.md-18-20 (1)
18-20: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winAdd a language identifier to the fenced error block.
Use
textorconsoleafter the opening fence. This fixes markdownlint MD040.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/pihole_scan/README.md` around lines 18 - 20, Update the fenced error block in the README to include a text or console language identifier after the opening fence, preserving the existing error message content.Source: Linters/SAST tools
docs/NOTIFICATIONS.md-49-49 (1)
49-49: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winFix the missing space in
dependenton.Change
dependentontodependent on. LanguageTool reports this typo in the notification settings guidance.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/NOTIFICATIONS.md` at line 49, Correct the typo in the notification settings guidance by changing “dependenton” to “dependent on” in the NTFPRCS_INCLUDED_SECTIONS description.Source: Linters/SAST tools
server/plugins/notification_processing/README.md-11-13 (1)
11-13: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winDocument prerequisites per notification type.
“Devices must have alerts enabled” is too broad.
new_devicesis not controlled by Alert Events, whiledown_devicesanddown_reconnecteduse Alert Down. Replace this statement with the per-type rules documented indocs/NOTIFICATIONS.md.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/notification_processing/README.md` around lines 11 - 13, Update the prerequisites section in the notification processor README to replace the broad alerts-enabled statement with per-notification-type rules, matching the definitions in docs/NOTIFICATIONS.md: identify that new_devices is not controlled by Alert Events, while down_devices and down_reconnected use Alert Down.server/plugins/snmp_discovery/README.md-20-22 (1)
20-22: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winUse valid MAC addresses in the supported-output examples.
6C:6C:6C:6C:6C:b6C1has a four-hex-digit final component. Replace it with a valid six-octet MAC address in both examples.Also applies to: 57-58
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/snmp_discovery/README.md` around lines 20 - 22, Update the SNMP output examples containing 6C:6C:6C:6C:6C:b6C1 to use a valid six-octet MAC address, applying the correction consistently to both referenced examples while leaving the other output formats unchanged.server/plugins/snmp_discovery/README.md-54-54 (1)
54-54: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winKeep SNMP OID examples synchronized with the working command.
- server/plugins/snmp_discovery/README.md#L54-L54: remove the extra
.1.1from the OID.- server/plugins/snmp_discovery/config.json#L490-L490: remove the space in
.1.3.6.1. 2.1....Both examples must match the working default command in
server/plugins/snmp_discovery/config.jsonLine [469].🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/snmp_discovery/README.md` at line 54, The SNMP OID examples must match the working default command: in server/plugins/snmp_discovery/README.md lines 54-54, remove the extra “.1.1”; in server/plugins/snmp_discovery/config.json lines 490-490, remove the space after “.1.3.6.1.”. Ensure both examples exactly match the default command at config.json lines 469.docs/PLUGINS_DEV.md-103-103 (1)
103-103: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winAdd language identifiers to all changed fenced blocks.
- docs/PLUGINS_DEV.md#L103-L103: label the directory-tree fence with
text.- server/plugins/snmp_discovery/README.md#L19-L19: label the output fence.
- server/plugins/snmp_discovery/README.md#L29-L29: label the Cisco configuration fence.
- server/plugins/snmp_discovery/README.md#L41-L41: label the
show snmpfence.- server/plugins/snmp_discovery/README.md#L47-L47: label the
snmpwalkfence.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/PLUGINS_DEV.md` at line 103, Label every changed fenced code block with the appropriate language identifier: use text for the directory-tree fence in docs/PLUGINS_DEV.md (103-103), and label the output fence (19-19), Cisco configuration fence (29-29), show snmp fence (41-41), and snmpwalk fence (47-47) in server/plugins/snmp_discovery/README.md.Source: Linters/SAST tools
server/plugins/omada_sdn_imp/README.md-6-6 (1)
6-6: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winCorrect the new README text.
Fix the user-facing errors, including
SNDtoSDN,controlertocontroller,tplinktoTP-Link,OAMDAtoOMADA,NetAlerXtoNetAlertX,populattopopulate,realtedtorelated,embdedtoembedded, andopnsesnetoOPNsense. Also useself-registrationand add the missing space in(4) and.Also applies to: 11-11, 18-21, 40-41, 46-46, 56-62
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/omada_sdn_imp/README.md` at line 6, Correct the user-facing README text throughout the documented sections: replace the listed spelling and capitalization errors with SDN, controller, TP-Link, OMADA, NetAlertX, populate, related, embedded, and OPNsense; use “self-registration” and insert the missing space in “(4) and”.Source: Linters/SAST tools
server/plugins/workflows/README.md-1-7 (1)
1-7: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winReplace the placeholder documentation.
TBCleaves the README incomplete. Add a concise overview of the workflows plugin, explain theAppEvents_histsetting, and document the user flow before merge.Based on learnings: do not use placeholders; provide complete, functional implementation blocks.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/workflows/README.md` around lines 1 - 7, Replace the TBC placeholder in the workflows plugin README overview with concise, complete documentation describing the plugin, explaining the AppEvents_hist setting, and outlining the user flow before merge; retain the existing Settings-page usage reference.Source: Learnings
server/plugins/omada_sdn_imp/README.md-8-8 (1)
8-8: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winFix the Markdown heading hierarchy.
#### Featuresskips the###level after## Overview. Change it to### Features.Proposed fix
-#### Features +### Features🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/omada_sdn_imp/README.md` at line 8, Update the Features heading in the README from level four to level three so it follows the ## Overview hierarchy, changing #### Features to ### Features.Source: Linters/SAST tools
server/plugins/workflows/config.json-32-44 (1)
32-44: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winReject invalid
AppEvents_histvalues.This setting has
input type numberwith no schema bounds, so negative history count input is accepted. Add a non-negative schema bound, or reject/clamp invalid values before the value reaches workflow retention or query logic. Define the maximum retention limit if one is required.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/workflows/config.json` around lines 32 - 44, The AppEvents_hist configuration accepts negative values because its number schema has no bounds. Update the AppEvents_hist type definition to enforce a non-negative minimum, and define an appropriate maximum retention bound if required by workflow retention or query logic; otherwise validate or clamp the value before downstream use.server/plugins/__test/test.py-11-11 (1)
11-11: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winEnsure
__testis explicitly excluded from plugin discovery.
server/plugins/__testhas noignore_pluginmarker and noconfig.json, while discovery reads directories unless they containignore_pluginor lackconfig.json. Addserver/plugins/__test/ignore_pluginif this directory is test-only and should not be treated as a plugin.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/__test/test.py` at line 11, Add an empty ignore_plugin marker under server/plugins/__test so plugin discovery explicitly skips this test-only directory; do not alter the sys.path setup.Source: Coding guidelines
server/plugins/adguard_import/README.md-3-27 (1)
3-27: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winReplace the template content before merge.
The README contains unreplaced placeholders and does not document the actual AdGuard import workflow. Replace
PREF_RUNwith the real manifest setting key, document the required settings, and fill in the author and release metadata.Based on learnings: do not use placeholders; provide complete, functional implementation blocks.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/adguard_import/README.md` around lines 3 - 27, Replace the template content in the plugin README with complete AdGuard import documentation: describe the actual workflow and use cases, replace PREF_RUN with the manifest’s real setting key, list the required settings and setup steps, and provide the actual author and release metadata. Remove all placeholder text, including generic tips, empty bullets, placeholder author handles, and release dates.Source: Learnings
server/plugins/pihole_api_scan/README.md-68-68 (1)
68-68: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winAdd language identifiers to the fenced examples.
markdownlint-cli2reports MD040 on Lines 68, 82, 94, 109, and 120. Add a language identifier such astextto each opening fence.Suggested Markdown fix
-``` +```textAlso applies to: 82-82, 94-94, 109-109, 120-120
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/pihole_api_scan/README.md` at line 68, Update the fenced code examples in the README at the affected sections to include a language identifier such as text on every opening fence, including the examples around lines 68, 82, 94, 109, and 120.Source: Linters/SAST tools
server/plugins/pihole_api_scan/README.md-115-115 (1)
115-115: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winCorrect the spelling in the missing-device guidance.
Change
skippstoskipson Line 115. LanguageTool flags the current spelling.Suggested text fix
- * The app skipps devices with invalid MACs + * The app skips devices with invalid MACs🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/pihole_api_scan/README.md` at line 115, In the missing-device guidance, update the misspelled word “skipps” to “skips” while leaving the surrounding text unchanged.Source: Linters/SAST tools
server/plugins/notification_processing/config.json-21-26 (1)
21-26: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winFix the grammar in the user-facing description.
Line 24 reads "A plugin to for advanced notification processing." Remove the extra word.
✏️ Proposed fix
- "string": "A plugin to for advanced notification processing." + "string": "A plugin for advanced notification processing."🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/notification_processing/config.json` around lines 21 - 26, Update the English user-facing description in the description configuration to remove the extra “to,” so it reads “A plugin for advanced notification processing.”server/plugins/pihole_scan/config.json-316-325 (1)
316-325: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winCorrect the Spanish WATCH description.
The
en_ustext mapswatchedValue1to IP,watchedValue2to Last Query,watchedValue3to Name. Thees_estext mapswatchedValue2to "Proveedor" andwatchedValue3to "Interfaz", and contains the duplicated words "is es". Spanish users get wrong field meanings.✏️ Proposed fix
- "string": "Envíe una notificación si los valores seleccionados cambian. Utilice <code>CTRL + clic</code> para seleccionar/deseleccionar. <ul> <li><code>watchedValue1</code> es IP</li><li><code>watchedValue2</code> es Proveedor</li><li><code>watchedValue3</code> is es Interfaz</li><li><code>watchedValue4</code> es N/A</li></ul>" + "string": "Envíe una notificación si los valores seleccionados cambian. Utilice <code>CTRL + clic</code> para seleccionar/deseleccionar. <ul> <li><code>watchedValue1</code> es IP</li><li><code>watchedValue2</code> es Última consulta</li><li><code>watchedValue3</code> es Nombre</li><li><code>watchedValue4</code> es N/A</li></ul>"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/pihole_scan/config.json` around lines 316 - 325, Correct the Spanish WATCH description string so watchedValue2 maps to Last Query and watchedValue3 maps to Name, matching the en_us description, and remove the duplicated “is es” wording while preserving the existing IP and N/A mappings.server/plugins/wake_on_lan/README.md-34-36 (1)
34-36: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winReplace the navigation placeholder.
Line 36 tells users to open Settings > Plugin name. This is not a usable navigation target. Replace it with the Wake-on-LAN plugin label used in Settings.
Based on learnings: Do not use placeholders; provide complete, functional implementation blocks.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/wake_on_lan/README.md` around lines 34 - 36, Update the Usage navigation instruction in the README to replace the “Plugin name” placeholder with the actual Wake-on-LAN plugin label shown in Settings, while preserving the existing Settings navigation path and formatting.Source: Learnings
server/plugins/ui_settings/config.json-250-276 (1)
250-276: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winCorrect the UI text.
Line 274 contains
teh. Line 461 containsselectivelly. Correct both strings before release.Proposed fix
- "string": "Default number of items shown in tables per page, for example in teh Devices lists." + "string": "Default number of items shown in tables per page, for example in the Devices list." ... - "string": "Columns and their order that are shown on the Devices page. Drag and drop to order the columns, click <code>x</code> to remove columns. You can also click into the field to selectivelly add fields. The <code>Name</code> and <code>Status</code> fields are required." + "string": "Columns and their order that are shown on the Devices page. Drag and drop to order the columns, click <code>x</code> to remove columns. You can also click into the field to selectively add fields. The <code>Name</code> and <code>Status</code> fields are required."Also applies to: 451-463
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/ui_settings/config.json` around lines 250 - 276, Correct the typos in the UI text entries: update the DEFAULT_PAGE_SIZE description from “teh” to “the” and fix “selectivelly” in the UI setting around the localized strings near the referenced second entry. Preserve the existing wording and configuration structure.
🧹 Nitpick comments (3)
server/plugins/snmp_discovery/README.md (1)
11-12: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winDo not use
publicas a copy-paste community string.The examples use the well-known SNMPv2c community
public. Replace it with a placeholder and state that SNMPv2c does not encrypt the community string. Keep the read-only ACL requirement explicit.Also applies to: 71-71
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/snmp_discovery/README.md` around lines 11 - 12, Update the SNMP walk examples in the README to use a clearly marked placeholder instead of the public community string, add that SNMPv2c does not encrypt community strings, and retain the explicit requirement that the configured community have read-only ACL permissions.server/plugins/_publisher_apprise/README.md (1)
26-28: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd language identifiers to the fenced blocks.
markdownlint-cli2reports MD040 for Lines [26], [31], and [36]. Mark the URL example astext. Mark thecurlandappriseexamples asbash.Proposed fence labels
-``` +```text https://api.telegram.org/bot<bottoken>/sendMessage?chat_id=<chatid>&text=%40%40TEXT%40%40 -``` +``` ... -``` +```bash curl -X POST -d '{"urls":"tgram://<bottoken>/<chatid>","body":"test body from curl","title":"test title from curl"}' -H "Content-Type: application/json" "http://192.168.1.2:9999/notify/" -``` +``` ... -``` +```bash apprise -vv -t "Test Message from apprise console" -b "Test Message from apprise console" \ tgram://<bottoken>/<chatid>/ -``` +```Also applies to: 31-33, 36-39
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/_publisher_apprise/README.md` around lines 26 - 28, Update the fenced code blocks in the README: label the Telegram URL example as text, and label the curl and apprise command examples as bash. Preserve the example contents unchanged.Source: Linters/SAST tools
server/README.md (1)
10-10: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winRemove the spaces inside the code span.
markdownlint-cli2reports MD038 for Line [10]. Write the path as../server/pluginswithout leading or trailing spaces inside the code span.Proposed Markdown fix
-|```../server/plugins ```| a folder containing all [plugins](/server/plugins/) that publish notifications or scan for devices| +|```../server/plugins```| a folder containing all [plugins](/server/plugins/) that publish notifications or scan for devices|🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/README.md` at line 10, Remove the trailing space inside the code span in the Markdown table entry, changing the displayed path to ../server/plugins while preserving the surrounding table content.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.gemini/skills/testing-workflow/SKILL.md:
- Line 94: Update the path documentation in the testing workflow skill to remove
the container-specific `/app/server/plugins` reference and use
repository-relative commands instead. Also review nearby references to
`/workspaces/NetAlertX` and `devcontainer-management`, replacing them with
Gemini CLI-compatible alternatives or clearly marking them as devcontainer-only.
In @.github/skills/plugin-run-development/SKILL.md:
- Around line 11-13: Update the plugin run-development instructions to derive
the executable entry point and command from each plugin’s config.json manifest
rather than assuming script.py; retain script.py only as a template-specific
example. Ensure the referenced plugin examples, including apprise.py,
freebox.py, and sync.py, are handled through their manifest-defined entry points
and preserve the requirement that server/plugins/**/*.py plugins use config.json
manifests.
In @.vscode/settings.json:
- Around line 35-39: Update the chat.tools.terminal.autoApprove configuration in
.vscode/settings.json to remove the cp entry or set it to false, so file-copy
operations require manual approval while preserving the other approved commands.
In `@docs/DOCKER_INSTALLATION.md`:
- Line 32: Remove the --cap-add=NET_BIND_SERVICE option from the Docker
installation example, since the documented PORT and GRAPHQL_PORT values exceed
1024. Only retain or explain this capability if the example explicitly supports
privileged ports.
In `@docs/PLUGINS_DEV_QUICK_START.md`:
- Line 17: Update the sample import paths in the quick-start instructions to
match the plugin’s relocated location under server/plugins, avoiding
server/server and server/plugins/plugins resolution. Adjust the import examples
near the affected setup commands so the direct test command can run
successfully.
In `@server/plugins/kea_api/script.py`:
- Around line 6-7: Correct the sys.path entries in the script startup so they
resolve to the actual server and plugins directories rather than appending
duplicate directory names. Update the path construction around the existing
sys.path.insert calls, preserving direct-script execution and enabling imports
of plugin_helper, helper, and const.
- Around line 59-66: Update the result-file handling around
plugin_objects.write_result_file() so successful Kea responses with result 3
also write an empty result, replacing any stale previous output. Ensure the file
is written once after processing either successful result, while preserving the
existing error handling for result 1.
In `@server/plugins/set_password/README.md`:
- Around line 11-12: Update the set_password README guidance around
SETPWD_enable_password to warn that 123456 is a public default credential and
instruct users to replace it with a unique password before enabling login;
retain the existing disable-login configuration guidance.
- Line 13: Replace the raw SHA-256 password-storage behavior documented for
SETPWD_password with a salted password KDF such as Argon2, bcrypt, or scrypt,
and update the README description to accurately reflect the implemented
stored-password scheme.
In `@server/plugins/unifi_api_import/README.md`:
- Around line 12-15: Update the UNIFIAPI_verify_ssl documentation in the README
to stop advising users to disable certificate verification. Instruct users to
keep verification enabled and install a certificate trusted by the NetAlertX
host or configure the required private CA.
---
Minor comments:
In @.gemini/skills/plugin-development/plugin-skill.md:
- Line 22: Update the manual-run guidance in the plugin skill documentation to
avoid hardcoded container-only paths: derive plugin and server paths from
__file__ in the example, or explicitly restrict the /app/server paths to
container execution. Ensure the documented repository-root command can import
shared modules such as plugin_helper.
In `@docs/COMMON_ISSUES.md`:
- Line 120: Update the ARPSCAN plugin guide link in COMMON_ISSUES.md to use a
verified repository-relative path or the full NetAlertX GitHub URL instead of
the site-root `/server/...` path, while preserving the existing link text.
In `@docs/NOTIFICATIONS.md`:
- Line 49: Correct the typo in the notification settings guidance by changing
“dependenton” to “dependent on” in the NTFPRCS_INCLUDED_SECTIONS description.
In `@docs/PLUGINS_DEV.md`:
- Line 103: Label every changed fenced code block with the appropriate language
identifier: use text for the directory-tree fence in docs/PLUGINS_DEV.md
(103-103), and label the output fence (19-19), Cisco configuration fence
(29-29), show snmp fence (41-41), and snmpwalk fence (47-47) in
server/plugins/snmp_discovery/README.md.
In `@server/plugins/__test/test.py`:
- Line 11: Add an empty ignore_plugin marker under server/plugins/__test so
plugin discovery explicitly skips this test-only directory; do not alter the
sys.path setup.
In `@server/plugins/_publisher_mqtt/README.md`:
- Line 3: Correct the broker name in the README description by replacing
“Mosquito” with “Mosquitto,” leaving the surrounding Home Assistant and MQTT
wording unchanged.
- Around line 166-186: The README discovery topic must use the Home Assistant
config endpoint. Update the documented topic for the binary sensor example to
append /config, matching the discovery topic format and the MQTT publisher’s
existing behavior.
In `@server/plugins/adguard_import/README.md`:
- Around line 3-27: Replace the template content in the plugin README with
complete AdGuard import documentation: describe the actual workflow and use
cases, replace PREF_RUN with the manifest’s real setting key, list the required
settings and setup steps, and provide the actual author and release metadata.
Remove all placeholder text, including generic tips, empty bullets, placeholder
author handles, and release dates.
In `@server/plugins/csv_backup/README.md`:
- Line 3: Correct the documentation proofreading issues: in
server/plugins/csv_backup/README.md lines 3-3, replace “Can be used for
importing” with a complete sentence such as “Use it to import”; in
server/plugins/db_cleanup/README.md lines 11-11, replace the typo “tehy” with
“they”.
In `@server/plugins/dhcp_leases/README.md`:
- Around line 46-48: Update the fenced examples in the README, including the
sections around the lease-file examples and the standalone TBC block, to specify
an appropriate language identifier such as text after each opening fence. Ensure
all referenced fences satisfy markdownlint MD040 without changing their
contents.
- Around line 52-58: Correct the example lease line in the “Example File Format”
section so both the MAC address and client ID use valid six-octet values,
preserving the documented field order and remaining sample data.
- Around line 42-48: Replace the TBC placeholder in the pihole format section
with a concrete five-field Pi-hole dhcp.leases example, ordered as primary ID,
secondary IP, hostname, MAC, and the remaining field, so users can map the
import fields correctly.
In `@server/plugins/freebox/README.md`:
- Line 11: Update the setup documentation wording: replace “se [remote setup]”
with “see [remote setup]”, correct “Freeboxe's” to “Freebox's”, and format the
UI navigation path as “Settings > Access Management” wherever applicable.
In `@server/plugins/icmp_scan/README.md`:
- Line 3: Correct the spelling of “suplementing plugins” to “supplementing
plugins” in the README description.
In `@server/plugins/ipneigh/README.md`:
- Line 28: Update the Release Date entry in the ipneigh README to replace the
invalid 31-Nov-2024 value with the confirmed valid release date, preserving the
existing date format.
- Around line 12-17: Update the setup guidance in the README to remove the
instruction to add interfaces in plugin settings, and direct users to configure
interfaces only through the existing SCAN_SUBNETS setting using the documented
format. Keep the Usage navigation and example consistent with the ipneigh.py
configuration behavior.
In `@server/plugins/kea_api/README.md`:
- Line 99: Update the README release date to an unambiguous ISO 8601 date in the
Release Date field, confirming whether the intended date is May 11 or November
5, 2026 before applying the change.
In `@server/plugins/mikrotik_scan/README.md`:
- Line 25: Correct the spelling in the DHCP lease documentation comment near the
`comment` field, changing “devies” to “devices” without altering the surrounding
text.
In `@server/plugins/notification_processing/config.json`:
- Around line 21-26: Update the English user-facing description in the
description configuration to remove the extra “to,” so it reads “A plugin for
advanced notification processing.”
In `@server/plugins/notification_processing/README.md`:
- Around line 11-13: Update the prerequisites section in the notification
processor README to replace the broad alerts-enabled statement with
per-notification-type rules, matching the definitions in docs/NOTIFICATIONS.md:
identify that new_devices is not controlled by Alert Events, while down_devices
and down_reconnected use Alert Down.
In `@server/plugins/omada_sdn_imp/README.md`:
- Line 6: Correct the user-facing README text throughout the documented
sections: replace the listed spelling and capitalization errors with SDN,
controller, TP-Link, OMADA, NetAlertX, populate, related, embedded, and
OPNsense; use “self-registration” and insert the missing space in “(4) and”.
- Line 8: Update the Features heading in the README from level four to level
three so it follows the ## Overview hierarchy, changing #### Features to ###
Features.
In `@server/plugins/pihole_api_scan/README.md`:
- Line 68: Update the fenced code examples in the README at the affected
sections to include a language identifier such as text on every opening fence,
including the examples around lines 68, 82, 94, 109, and 120.
- Line 115: In the missing-device guidance, update the misspelled word “skipps”
to “skips” while leaving the surrounding text unchanged.
In `@server/plugins/pihole_scan/config.json`:
- Around line 316-325: Correct the Spanish WATCH description string so
watchedValue2 maps to Last Query and watchedValue3 maps to Name, matching the
en_us description, and remove the duplicated “is es” wording while preserving
the existing IP and N/A mappings.
In `@server/plugins/pihole_scan/README.md`:
- Around line 18-20: Update the fenced error block in the README to include a
text or console language identifier after the opening fence, preserving the
existing error message content.
In `@server/plugins/snmp_discovery/README.md`:
- Around line 20-22: Update the SNMP output examples containing
6C:6C:6C:6C:6C:b6C1 to use a valid six-octet MAC address, applying the
correction consistently to both referenced examples while leaving the other
output formats unchanged.
- Line 54: The SNMP OID examples must match the working default command: in
server/plugins/snmp_discovery/README.md lines 54-54, remove the extra “.1.1”; in
server/plugins/snmp_discovery/config.json lines 490-490, remove the space after
“.1.3.6.1.”. Ensure both examples exactly match the default command at
config.json lines 469.
In `@server/plugins/ui_settings/config.json`:
- Around line 250-276: Correct the typos in the UI text entries: update the
DEFAULT_PAGE_SIZE description from “teh” to “the” and fix “selectivelly” in the
UI setting around the localized strings near the referenced second entry.
Preserve the existing wording and configuration structure.
In `@server/plugins/wake_on_lan/README.md`:
- Around line 34-36: Update the Usage navigation instruction in the README to
replace the “Plugin name” placeholder with the actual Wake-on-LAN plugin label
shown in Settings, while preserving the existing Settings navigation path and
formatting.
In `@server/plugins/workflows/config.json`:
- Around line 32-44: The AppEvents_hist configuration accepts negative values
because its number schema has no bounds. Update the AppEvents_hist type
definition to enforce a non-negative minimum, and define an appropriate maximum
retention bound if required by workflow retention or query logic; otherwise
validate or clamp the value before downstream use.
In `@server/plugins/workflows/README.md`:
- Around line 1-7: Replace the TBC placeholder in the workflows plugin README
overview with concise, complete documentation describing the plugin, explaining
the AppEvents_hist setting, and outlining the user flow before merge; retain the
existing Settings-page usage reference.
---
Nitpick comments:
In `@server/plugins/_publisher_apprise/README.md`:
- Around line 26-28: Update the fenced code blocks in the README: label the
Telegram URL example as text, and label the curl and apprise command examples as
bash. Preserve the example contents unchanged.
In `@server/plugins/snmp_discovery/README.md`:
- Around line 11-12: Update the SNMP walk examples in the README to use a
clearly marked placeholder instead of the public community string, add that
SNMPv2c does not encrypt community strings, and retain the explicit requirement
that the configured community have read-only ACL permissions.
In `@server/README.md`:
- Line 10: Remove the trailing space inside the code span in the Markdown table
entry, changing the displayed path to ../server/plugins while preserving the
surrounding table content.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: f8cd8da1-dae6-425c-a3aa-9b0c08404fd9
⛔ Files ignored due to path filters (9)
server/plugins/_publisher_apprise/apprise_telegram.pngis excluded by!**/*.pngserver/plugins/_publisher_mqtt/Deleting_MQTT_Plugin_Objects.pngis excluded by!**/*.pngserver/plugins/_publisher_webhook/Discord_Config.pngis excluded by!**/*.pngserver/plugins/arp_scan/arp-scan-settings.pngis excluded by!**/*.pngserver/plugins/nmap_scan/nmap_ports_services.pngis excluded by!**/*.pngserver/plugins/omada_sdn_imp/omada_account_sample.pngis excluded by!**/*.pngserver/plugins/omada_sdn_openapi/omada_sdn_openapi_settings.pngis excluded by!**/*.pngserver/plugins/sync/sync_hub.pngis excluded by!**/*.pngserver/plugins/unifi_import/full_run.lockis excluded by!**/*.lock
📒 Files selected for processing (245)
.devcontainer/Dockerfile.gemini/internal-docs/PRDs/.gitkeep.gemini/skills/plugin-development/plugin-skill.md.gemini/skills/project-navigation/SKILL.md.gemini/skills/testing-workflow/SKILL.md.github/copilot-instructions.md.github/skills/database-patterns/SKILL.md.github/skills/plugin-run-development/SKILL.md.github/skills/project-navigation/SKILL.md.github/skills/testing-workflow/SKILL.md.gitignore.vscode/settings.jsonDockerfileREADME.mddocker-compose.ymldocs/ADVISORY_MULTI_NETWORK.mddocs/ADVISORY_MULTI_SITE_MONITORING.mddocs/API_SYNC.mddocs/BACKUPS.mddocs/COMMON_ISSUES.mddocs/DOCKER_INSTALLATION.mddocs/FILE_PERMISSIONS.mddocs/HOME_ASSISTANT.mddocs/INITIAL_SETUP.mddocs/MIGRATION.mddocs/NOTIFICATIONS.mddocs/PERFORMANCE.mddocs/PIHOLE_GUIDE.mddocs/PLUGINS.mddocs/PLUGINS_DEV.mddocs/PLUGINS_DEV_DATASOURCES.mddocs/PLUGINS_DEV_DATA_CONTRACT.mddocs/PLUGINS_DEV_QUICK_START.mddocs/PLUGINS_DEV_SETTINGS.mddocs/REMOTE_NETWORKS.mddocs/REST_IMPORT.mdfront/js/device-columns.jsfront/php/templates/language/ca_ca.jsonfront/php/templates/language/cs_cz.jsonfront/php/templates/language/de_de.jsonfront/php/templates/language/en_us.jsonfront/php/templates/language/es_es.jsonfront/php/templates/language/fr_fr.jsonfront/php/templates/language/it_it.jsonfront/php/templates/language/ja_jp.jsonfront/php/templates/language/pl_pl.jsonfront/php/templates/language/pt_br.jsonfront/php/templates/language/pt_pt.jsonfront/php/templates/language/ru_ru.jsonfront/php/templates/language/tr_tr.jsonfront/php/templates/language/uk_ua.jsonfront/php/templates/language/zh_cn.jsonfront/pluginsCore.phpfront/settings.phpscripts/db_empty/db_empty.pyserver/README.mdserver/api_server/api_server_start.pyserver/api_server/dbquery_endpoint.pyserver/api_server/history_endpoint.pyserver/api_server/logs_endpoint.pyserver/api_server/sessions_endpoint.pyserver/config_paths.pyserver/initialise.pyserver/models/device_instance.pyserver/plugin.pyserver/plugins/README.mdserver/plugins/__template/README.mdserver/plugins/__template/config.jsonserver/plugins/__template/ignore_pluginserver/plugins/__template/rename_me.pyserver/plugins/__test/test.pyserver/plugins/_publisher_apprise/README.mdserver/plugins/_publisher_apprise/apprise.pyserver/plugins/_publisher_apprise/config.jsonserver/plugins/_publisher_email/README.mdserver/plugins/_publisher_email/config.jsonserver/plugins/_publisher_email/email_smtp.pyserver/plugins/_publisher_mqtt/README.mdserver/plugins/_publisher_mqtt/config.jsonserver/plugins/_publisher_mqtt/mqtt.pyserver/plugins/_publisher_ntfy/README.mdserver/plugins/_publisher_ntfy/config.jsonserver/plugins/_publisher_ntfy/ntfy.pyserver/plugins/_publisher_pushover/README.mdserver/plugins/_publisher_pushover/config.jsonserver/plugins/_publisher_pushover/pushover.pyserver/plugins/_publisher_pushsafer/README.mdserver/plugins/_publisher_pushsafer/config.jsonserver/plugins/_publisher_pushsafer/pushsafer.pyserver/plugins/_publisher_telegram/README.mdserver/plugins/_publisher_telegram/config.jsonserver/plugins/_publisher_telegram/tg.pyserver/plugins/_publisher_webhook/README.mdserver/plugins/_publisher_webhook/config.jsonserver/plugins/_publisher_webhook/webhook.pyserver/plugins/adguard_export/README.mdserver/plugins/adguard_export/config.jsonserver/plugins/adguard_export/script.pyserver/plugins/adguard_import/README.mdserver/plugins/adguard_import/adguard_import.pyserver/plugins/adguard_import/config.jsonserver/plugins/arp_scan/README.mdserver/plugins/arp_scan/config.jsonserver/plugins/arp_scan/script.pyserver/plugins/asuswrt_import/README.mdserver/plugins/asuswrt_import/config.jsonserver/plugins/asuswrt_import/script.pyserver/plugins/avahi_scan/README.mdserver/plugins/avahi_scan/avahi_scan.pyserver/plugins/avahi_scan/config.jsonserver/plugins/csv_backup/README.mdserver/plugins/csv_backup/config.jsonserver/plugins/csv_backup/script.pyserver/plugins/custom_props/README.mdserver/plugins/custom_props/config.jsonserver/plugins/db_cleanup/README.mdserver/plugins/db_cleanup/config.jsonserver/plugins/db_cleanup/script.pyserver/plugins/ddns_update/README.mdserver/plugins/ddns_update/README_DE.mdserver/plugins/ddns_update/config.jsonserver/plugins/ddns_update/script.pyserver/plugins/dhcp_leases/ASUS_ROUTERS.mdserver/plugins/dhcp_leases/README.mdserver/plugins/dhcp_leases/config.jsonserver/plugins/dhcp_leases/script.pyserver/plugins/dhcp_servers/README.mdserver/plugins/dhcp_servers/config.jsonserver/plugins/dhcp_servers/script.pyserver/plugins/dig_scan/README.mdserver/plugins/dig_scan/config.jsonserver/plugins/dig_scan/digscan.pyserver/plugins/freebox/README.mdserver/plugins/freebox/config.jsonserver/plugins/freebox/freebox.pyserver/plugins/fritzbox/README.mdserver/plugins/fritzbox/config.jsonserver/plugins/fritzbox/fritzbox.pyserver/plugins/icmp_scan/README.mdserver/plugins/icmp_scan/config.jsonserver/plugins/icmp_scan/icmp.pyserver/plugins/internet_ip/README.mdserver/plugins/internet_ip/config.jsonserver/plugins/internet_ip/script.pyserver/plugins/internet_speedtest/README.mdserver/plugins/internet_speedtest/config.jsonserver/plugins/internet_speedtest/script.pyserver/plugins/ipneigh/README.mdserver/plugins/ipneigh/config.jsonserver/plugins/ipneigh/ipneigh.pyserver/plugins/kea_api/README.mdserver/plugins/kea_api/config.jsonserver/plugins/kea_api/script.pyserver/plugins/luci_import/README.mdserver/plugins/luci_import/config.jsonserver/plugins/luci_import/script.pyserver/plugins/maintenance/README.mdserver/plugins/maintenance/config.jsonserver/plugins/maintenance/maintenance.pyserver/plugins/mikrotik_scan/README.mdserver/plugins/mikrotik_scan/config.jsonserver/plugins/mikrotik_scan/mikrotik.pyserver/plugins/nbtscan_scan/README.mdserver/plugins/nbtscan_scan/config.jsonserver/plugins/nbtscan_scan/nbtscan.pyserver/plugins/newdev_template/README.mdserver/plugins/newdev_template/config.jsonserver/plugins/nmap_dev_scan/README.mdserver/plugins/nmap_dev_scan/config.jsonserver/plugins/nmap_dev_scan/nmap_dev.pyserver/plugins/nmap_scan/README.mdserver/plugins/nmap_scan/config.jsonserver/plugins/nmap_scan/script.pyserver/plugins/notification_processing/README.mdserver/plugins/notification_processing/config.jsonserver/plugins/nslookup_scan/README.mdserver/plugins/nslookup_scan/config.jsonserver/plugins/nslookup_scan/nslookup.pyserver/plugins/omada_sdn_imp/README.mdserver/plugins/omada_sdn_imp/config.jsonserver/plugins/omada_sdn_imp/omada_sdn.pyserver/plugins/omada_sdn_openapi/README.mdserver/plugins/omada_sdn_openapi/config.jsonserver/plugins/omada_sdn_openapi/script.pyserver/plugins/pihole_api_scan/README.mdserver/plugins/pihole_api_scan/config.jsonserver/plugins/pihole_api_scan/pihole_api_scan.pyserver/plugins/pihole_scan/README.mdserver/plugins/pihole_scan/config.jsonserver/plugins/plugin_helper.pyserver/plugins/rest_import/README.mdserver/plugins/rest_import/config.jsonserver/plugins/rest_import/rest_import.pyserver/plugins/set_password/README.mdserver/plugins/set_password/config.jsonserver/plugins/snmp_discovery/README.mdserver/plugins/snmp_discovery/config.jsonserver/plugins/snmp_discovery/script.pyserver/plugins/sync/README.mdserver/plugins/sync/config.jsonserver/plugins/sync/sync.pyserver/plugins/ui_settings/README.mdserver/plugins/ui_settings/config.jsonserver/plugins/unifi_api_import/README.mdserver/plugins/unifi_api_import/config.jsonserver/plugins/unifi_api_import/unifi_api_import.pyserver/plugins/unifi_import/README.mdserver/plugins/unifi_import/config.jsonserver/plugins/unifi_import/script.pyserver/plugins/vendor_update/README.mdserver/plugins/vendor_update/config.jsonserver/plugins/vendor_update/script.pyserver/plugins/wake_on_lan/README.mdserver/plugins/wake_on_lan/config.jsonserver/plugins/wake_on_lan/wake_on_lan.pyserver/plugins/website_monitor/README.mdserver/plugins/website_monitor/config.jsonserver/plugins/website_monitor/script.pyserver/plugins/workflows/README.mdserver/plugins/workflows/config.jsonserver/workflows/actions.pytest/api_endpoints/test_auth_endpoints.pytest/api_endpoints/test_dbquery_endpoints.pytest/api_endpoints/test_device_endpoints.pytest/api_endpoints/test_events_endpoints.pytest/api_endpoints/test_graphq_endpoints.pytest/api_endpoints/test_health_endpoints.pytest/api_endpoints/test_history_endpoints.pytest/api_endpoints/test_languages_endpoint.pytest/api_endpoints/test_logs_endpoints.pytest/api_endpoints/test_mcp_disabled_tools.pytest/api_endpoints/test_mcp_openapi_spec.pytest/api_endpoints/test_plugin_stats_endpoints.pytest/api_endpoints/test_sessions_endpoints.pytest/api_endpoints/test_settings_endpoints.pytest/api_endpoints/test_sync_endpoint.pytest/db/test_camelcase_migration.pytest/db/test_db_cleanup.pytest/db/test_timestamp_migration.pytest/plugins/test_adguard_export.pytest/scan/test_device_field_lock.pytest/server/test_datetime_utils.pytest/server/test_graphql_endpoints.pytest/server/test_plugin_history_filtering.pytest/test_plugin_helper.py
| - `/app` — primary location where Python runs in production | ||
| - `/app/server` — symlink to `/workspaces/NetAlertX/server` | ||
| - `/app/front/plugins` — symlink to `/workspaces/NetAlertX/front/plugins` | ||
| - `/app/server/plugins` — symlink to `/workspaces/NetAlertX/server/plugins` |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
Keep the Gemini skill independent of container-only paths.
Line 94 documents /app/server/plugins, while this skill also uses /workspaces/NetAlertX and devcontainer-management. These paths and tools are not guaranteed in the Gemini CLI environment. Use repository-relative commands, or clearly mark this section as devcontainer-only.
Based on learnings, skill files under .gemini/skills must use tools available to Gemini CLI and avoid devcontainer-only path and tool references.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.gemini/skills/testing-workflow/SKILL.md at line 94, Update the path
documentation in the testing workflow skill to remove the container-specific
`/app/server/plugins` reference and use repository-relative commands instead.
Also review nearby references to `/workspaces/NetAlertX` and
`devcontainer-management`, replacing them with Gemini CLI-compatible
alternatives or clearly marking them as devcontainer-only.
Source: Learnings
| 2. Find the plugin in `server/plugins/<code_name>/`. | ||
| 3. Read the plugin's `config.json` and `script.py` to understand its functionality and settings. | ||
| 4. Formulate and run the command: `python3 front/plugins/<code_name>/script.py`. | ||
| 4. Formulate and run the command: `python3 server/plugins/<code_name>/script.py`. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Derive the entry point from config.json.
script.py is not the entry point for every plugin. The supplied plugin set includes server/plugins/_publisher_apprise/apprise.py, server/plugins/freebox/freebox.py, and server/plugins/sync/sync.py. Following these instructions for those plugins causes a file-not-found error.
Document execution through the command defined by the plugin manifest. Keep script.py only as a template-specific example.
As per coding guidelines, plugins under server/plugins/**/*.py must use config.json manifests.
Also applies to: 18-20, 27-30
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/skills/plugin-run-development/SKILL.md around lines 11 - 13, Update
the plugin run-development instructions to derive the executable entry point and
command from each plugin’s config.json manifest rather than assuming script.py;
retain script.py only as a template-specific example. Ensure the referenced
plugin examples, including apprise.py, freebox.py, and sync.py, are handled
through their manifest-defined entry points and preserve the requirement that
server/plugins/**/*.py plugins use config.json manifests.
Source: Coding guidelines
| --network=host \ | ||
| --cap-add=NET_RAW \ | ||
| --cap-add=NET_ADMIN \ | ||
| --cap-add=NET_BIND_SERVICE \ |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Do not grant NET_BIND_SERVICE for the documented ports.
Line 32 permits binding ports below 1024. The documented PORT and GRAPHQL_PORT values are above 1024, so this capability is unnecessary for the example. Remove it, or document the condition that requires a privileged port.
Proposed fix
- --cap-add=NET_BIND_SERVICE \📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| --cap-add=NET_BIND_SERVICE \ |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/DOCKER_INSTALLATION.md` at line 32, Remove the
--cap-add=NET_BIND_SERVICE option from the Docker installation example, since
the documented PORT and GRAPHQL_PORT values exceed 1024. Only retain or explain
this capability if the example explicitly supports privileged ports.
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
🛑 Comments failed to post (5)
server/plugins/kea_api/script.py (2)
6-7: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Fix the module search paths.
Lines 6-7 resolve to
/app/server/serverand/app/server/plugins/plugins. The configured command runs this script directly, soplugin_helper,helper, andconstcannot be imported.Proposed fix
-sys.path.insert(0, os.path.join(os.path.dirname(__file__), '../../server')) -sys.path.insert(0, os.path.join(os.path.dirname(__file__), '../plugins')) +PLUGIN_DIR = os.path.abspath(os.path.join(os.path.dirname(__file__), '..')) +SERVER_DIR = os.path.dirname(PLUGIN_DIR) +sys.path.extend([PLUGIN_DIR, SERVER_DIR])📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.PLUGIN_DIR = os.path.abspath(os.path.join(os.path.dirname(__file__), '..')) SERVER_DIR = os.path.dirname(PLUGIN_DIR) sys.path.extend([PLUGIN_DIR, SERVER_DIR])🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/kea_api/script.py` around lines 6 - 7, Correct the sys.path entries in the script startup so they resolve to the actual server and plugins directories rather than appending duplicate directory names. Update the path construction around the existing sys.path.insert calls, preserving direct-script execution and enabling imports of plugin_helper, helper, and const.
59-66: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Write an empty result for a successful empty Kea response.
If Kea returns result
3, this run has no leases. The previous non-empty result file remains unchanged. The next plugin import can then process stale leases. Write the result file once after processing any successful result, including result3.Proposed fix
count = 0 + received_successful_result = False for entry in data: text = entry.get('text', '[API provided no text]') # Result: 0 (success), 1 (error), or 3 (empty). if entry['result'] == 0: + received_successful_result = True leases = entry['arguments']['leases'] for lease in leases: ... - plugin_objects.write_result_file() - mylog('verbose', [f'[{pluginName}] Kea API response: {text}']) mylog('verbose', [f'[{pluginName}] Successfully imported {count} devices reported by Kea API']) elif entry['result'] == 1: mylog('none', [f'[{pluginName}] ⚠ ERROR: Kea API indicated error: {text}']) elif entry['result'] == 3: + received_successful_result = True mylog('verbose', [f'[{pluginName}] Kea API indicates no entries found: {text}']) + + if received_successful_result: + plugin_objects.write_result_file()📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.count = 0 received_successful_result = False for entry in data: text = entry.get('text', '[API provided no text]') # Result: 0 (success), 1 (error), or 3 (empty). if entry['result'] == 0: received_successful_result = True leases = entry['arguments']['leases'] for lease in leases: ... mylog('verbose', [f'[{pluginName}] Kea API response: {text}']) mylog('verbose', [f'[{pluginName}] Successfully imported {count} devices reported by Kea API']) elif entry['result'] == 1: mylog('none', [f'[{pluginName}] ⚠ ERROR: Kea API indicated error: {text}']) elif entry['result'] == 3: received_successful_result = True mylog('verbose', [f'[{pluginName}] Kea API indicates no entries found: {text}']) if received_successful_result: plugin_objects.write_result_file()🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/kea_api/script.py` around lines 59 - 66, Update the result-file handling around plugin_objects.write_result_file() so successful Kea responses with result 3 also write an empty result, replacing any stale previous output. Ensure the file is written once after processing either successful result, while preserving the existing error handling for result 1.server/plugins/set_password/README.md (2)
11-12: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Warn users before enabling the default credential.
The documented password
123456is a known credential. If users enableSETPWD_enable_passwordwithout changing it, the login uses a public default. Require a unique password before enabling login.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/set_password/README.md` around lines 11 - 12, Update the set_password README guidance around SETPWD_enable_password to warn that 123456 is a public default credential and instruct users to replace it with a unique password before enabling login; retain the existing disable-login configuration guidance.
13-13: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -euo pipefail rg -n -C 6 'SETPWD_enable_password|sha256|SHA256|hashlib' \ server/plugins front test \ --glob '*.py' --glob '*.php' --glob '*.js' --glob 'config.json' || trueRepository: netalertx/NetAlertX
Length of output: 50375
🏁 Script executed:
#!/bin/bash set -euo pipefail printf 'README around line 13:\n' sed -n '1,35p' server/plugins/set_password/README.md printf '\nLogin implementation around comparison:\n' sed -n '100,135p' front/index.php printf '\nTransform usage around sha256:\n' sed -n '1,50p' front/js/settings_utils.js sed -n '680,715p' front/js/settings_utils.js sed -n '860,882p' front/js/settings_utils.js printf '\nRelevant config declarations:\n' sed -n '60,92p' server/plugins/set_password/config.json sed -n '29,115p' test/ui/test_ui_login.py printf '\nRead-only deterministic SHA256 equality probe for default password:\n' python3 - <<'PY' import hashlib plaintext = "123456" direct = hashlib.sha256(plaintext.encode("utf-8")).hexdigest() hmac_based = hashlib.sha256((direct + plaintext).encode("utf-8")).hexdigest() frontend_like = direct # CryptoJS.SHA256(val).toString(CryptoJS.enc.Hex) print({"plaintext": plaintext, "sha256(direct)": direct, "sha256(direct+plaintext)": hmac_based, "frontend_like": frontend_like, "store_equals_direct": direct == h2sha256:=direct, "input_direct_matches_store": direct == direct}) PYRepository: netalertx/NetAlertX
Length of output: 9319
🏁 Script executed:
#!/bin/bash set -euo pipefail printf 'Read-only deterministic SHA256 equality probe for default password:\n' python3 - <<'PY' import hashlib plaintext = "123456" direct = hashlib.sha256(plaintext.encode("utf-8")).hexdigest() hmac_based = hashlib.sha256((direct + plaintext).encode("utf-8")).hexdigest() frontend_like = direct comparison = direct == frontend_like print({ "plaintext": plaintext, "sha256(direct)": direct, "sha256(direct+plaintext)": hmac_based, "frontend_like": frontend_like, "store_equals_direct": comparison, "input_direct_matches_store": direct == direct }) PYRepository: netalertx/NetAlertX
Length of output: 581
Use a password KDF for login password storage.
SETPWD_passwordis hashed with the same raw SHA-256 used by the login form (sha256transformer ->hash('sha256', $password)), so the default123456is stored as an unsalted digest. Store passwords with a salted KDF such as Argon2, bcrypt, or scrypt, and update the README to match the stored scheme.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/set_password/README.md` at line 13, Replace the raw SHA-256 password-storage behavior documented for SETPWD_password with a salted password KDF such as Argon2, bcrypt, or scrypt, and update the README description to accurately reflect the implemented stored-password scheme.server/plugins/unifi_api_import/README.md (1)
12-15: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Do not advise users to disable certificate verification.
Line 15 directs users to disable verification when the controller has no certificate. This can let an on-path attacker impersonate the controller and intercept
UNIFIAPI_api_keytraffic. Keep verification enabled. Instruct users to install a certificate trusted by the NetAlertX host or configure the required private CA.Proposed fix
- `UNIFIAPI_verify_ssl` : To skip SSL with you don't have an SSL certificate + `UNIFIAPI_verify_ssl`: Keep certificate verification enabled. Install a certificate trusted by the NetAlertX host, or configure the required private CA.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.- `UNIFIAPI_api_key` : You can generate your API key under the _Your API Keys_ section. - `UNIFIAPI_base_url` : You can find your base url in the _API Request Format_ section, e.g. `https://192.168.100.1/proxy/network/integration/` - `UNIFIAPI_api_version` : You can find your version as part of the url in the _API Request Format_ section, e.g. `v1` - `UNIFIAPI_verify_ssl`: Keep certificate verification enabled. Install a certificate trusted by the NetAlertX host, or configure the required private CA.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/plugins/unifi_api_import/README.md` around lines 12 - 15, Update the UNIFIAPI_verify_ssl documentation in the README to stop advising users to disable certificate verification. Instruct users to keep verification enabled and install a certificate trusted by the NetAlertX host or configure the required private CA.
|
@coderabbitai review |
|
1 participant
Summary by CodeRabbit
Bug Fixes
Documentation
Chores